Privacy Policy

Who we are

LYLA is an NHS-commissioned contraceptive care service operated in partnership with Inspire Pharmacy (GPhC Premises Registration: 9011381). Contact: +44 7435 243728

What data we collect

• Name and contact details provided when booking
• Health information shared during your consultation
• Technical data (browser type, IP address) via analytics
• Email address if you contact us directly
• Email address and a send date if you set a pill reminder

How we use your data

• To provide and manage your contraceptive care
• To communicate about your appointments
• To comply with NHS commissioning obligations
• To improve our service
• To send a pill reminder email, only if you ask for one

Legal basis for processing

We process your data under Article 6(1)(b) of UK GDPR (contract performance) and Article 9(2)(h) (healthcare provision). All clinical data is handled in accordance with NHS data protection standards. Pill reminder emails are sent only with your consent, under Article 6(1)(a), which you can withdraw at any time.

Who we share your data with

• Inspire Pharmacy clinical team (your care providers)
• NHS commissioning bodies as required
• The services that store and send pill reminders, acting only on our instructions
• We never sell your data to third parties
• We do not share with your GP without your explicit consent

How long we keep your data

Clinical records are retained for a minimum of 8 years in line with NHS guidelines. Non-clinical contact data is deleted after 2 years of inactivity.

Pill reminder emails

If you set a reminder at lylaforshe.co.uk/pill-reminder, we send you one email on the date you choose. It is not a newsletter and we never use your address for marketing.

What we store.

• Your email address and the date to send the reminder
• A scrambled, one-way code made from your email address, so we can cancel all of your reminders from a single link
• A scrambled, one-way code made from your IP address, used only to limit how many reminders can be set from one connection in an hour. We never store the IP address itself.

We don't store your name, which pill you take, or whether you are a LYLA patient. A reminder is not linked to any clinical record.

Why. Your consent, given by ticking the box on the reminder form (UK GDPR Article 6(1)(a)). Limiting repeat submissions is in our legitimate interest in stopping the form from being used to send unwanted email (Article 6(1)(f)).

How long we keep it. A reminder is deleted as soon as the email is sent, or when you cancel it, whichever comes first. If the email can't be delivered, the reminder is deleted no later than 7 days after its send date. The IP-based code is deleted within 24 hours.

Who handles it. One service provider acts for us and only on our instructions: alwaysdata, which hosts the database in France. Where a provider handles data outside the UK, the transfer is protected by the safeguards UK GDPR requires.

Cancelling. Every reminder email includes a link to cancel any other reminders you've set. It deletes them, and your address, straight away. You can also ask us to do it using the contact details below.

Your rights

Under UK GDPR you have the right to: access your personal data, correct inaccurate data, request erasure (where legally permitted), object to processing, and lodge a complaint with the ICO (ico.org.uk).

Cookies

We use minimal essential cookies for site functionality and Google Analytics to understand traffic patterns. No advertising cookies are used.

Contact us

For privacy queries: +44 7435 243728

You may also contact the ICO at ico.org.uk